CND Cheat Sheet 2026

The 30 highest-yield CND facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the function of a Security Information and Event Management (SIEM) system? → To monitor, detect, and respond to security incidents by analyzing event data
2. Which incident response phase involves removing malware, closing vulnerabilities, and restoring affected systems to normal operation? → Eradication
3. Which CND control specifically addresses preventing unauthorized software execution on endpoints through policy-based restrictions? → Software Restriction Policies (SRP) or AppLocker
4. When performing forensic disk imaging, which tool creates a bit-for-bit copy and generates an MD5/SHA hash to verify integrity? → dd or dcfldd
5. Which network security measure is used to authenticate users based on their physical characteristics? → Biometric authentication
6. Which MITRE framework maps adversary tactics, techniques, and procedures (TTPs) and is widely used to inform threat assessments and detection strategies? → MITRE ATT&CK
7. Which protocol provides centralized AAA (Authentication, Authorization, and Accounting) services and is commonly used with network devices via TCP port 49? → TACACS+
8. Which Windows artifact is most useful for determining which programs were recently executed on a system? → Prefetch files
9. Why is multi-factor authentication (MFA) important for protecting endpoint access? → It ensures an attacker with stolen credentials alone cannot log in
10. What is the primary function of a Demilitarized Zone (DMZ) in a network? → To provide a secure zone for public-facing services while protecting internal networks
11. Why is regular vulnerability scanning important in network security? → To identify and address vulnerabilities before they are exploited
12. What is the PRIMARY purpose of obtaining CND certification in Certified Network Defender? → To demonstrate verified competency and adherence to professional standards
13. What is the key difference between IDS and IPS deployment in a network? → IPS is placed inline and can block traffic; IDS passively monitors
14. What is the significance of timestamps in log analysis during a forensic investigation? → They establish the sequence and timing of events
15. Which tool is commonly used for capturing and analyzing raw network packets during forensic investigation? → Wireshark
16. Which NIST SP 800-53 control family specifically addresses planning and policy for information security? → Planning (PL)
17. Which activity in a risk management program involves continuously tracking identified risks, monitoring residual risk, and identifying new risks over time? → Risk monitoring and review
18. What does the concept of containment refer to during an incident response? → To limit the spread of the incident, minimizing further damage
19. What does a next-generation firewall (NGFW) provide that a traditional stateful firewall does not? → Deep packet inspection and application awareness
20. Which GDPR principle requires that personal data be collected only for specified, explicit, and legitimate purposes? → Purpose limitation
21. What is the MOST important leadership quality for a CND certified professional managing a team? → Demonstrating integrity, clear communication, and ability to develop team members
22. Which artifact should an incident responder collect FIRST from a live Windows system before pulling the power? → Contents of RAM (memory dump)
23. Which type of malware analysis runs a suspicious file in an isolated environment to observe its behavior without risking production systems? → Dynamic analysis (sandboxing)
24. Under GDPR, what is the maximum timeframe within which a data breach affecting EU citizens' rights must be reported to the supervisory authority? → 72 hours
25. How does a risk assessment help with vulnerability management? → By helping prioritize vulnerabilities based on their risk to the organization
26. What is a zero-day vulnerability? → A vulnerability that is exploited immediately upon discovery, without a fix available
27. Which risk analysis method uses expert opinion and descriptive ratings such as 'High,' 'Medium,' and 'Low' rather than numerical values? → Qualitative analysis
28. What is the purpose of Windows Defender Credential Guard? → Isolate and protect NTLM/Kerberos credential hashes in a virtualized container from theft
29. What is the significance of incident response testing? → To test the plan’s effectiveness and make necessary improvements
30. What is the primary function of a Security Information and Event Management (SIEM) system in incident response? → Aggregating and correlating log data from multiple sources to detect incidents